9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0.7z
- SHA256 c9fe72a7a68c539350a2eae1d3e72072a9aca807d4457bb209225199ac59c591
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0.7z
- Size 84KB
- Sample260414-capfbaav6q
- SHA256 c9fe72a7a68c539350a2eae1d3e72072a9aca807d4457bb209225199ac59c591
- MD5 5e29278187892a2fd9b5b8e1f2cb3bbe
- SHA1 d348b114e29dbbd05bcb316f331eca36a45f17f1
- SHA512 4457ffe04e4eb4b1a57e0e3afa3988e2253218374248a9f7737a78cde9d8cb26bef79fadd7a72313ff88dfa7e2eca9fb4f33fd3d50be4a5ecaad7053da7c175d
- SSDEEP 1536:kdOsUDdl2r3W8sq6WWWcW2Hr2hBRFvyerp8WWCXs7A+ICf5BxA33xxvUxzxUbVkL:rRl2bWTqjBcWt/Rrp7NXTefZQhxcxzxx
- TLSH T1E5830288E184533731E70FFC01D8AE6FF9E56B0E2B1DCC62788AF75484B68576752249
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0.exe
File Explorer
-
9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0.7z.7z 84KB
-
9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0.exe.exe 179KB
9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0.exe
- IMPHASH eea2562baf71bb381372b742a8d0a394
- SHA256 9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0
- MD5 06ce6cd8bde756265f95fcf4eecadbe9
- SHA1 bacf50b20f1cf2165ac96535aeac36b49c8a8677
- SHA512 b13677539da247707e7016c56aaba889826648b3050428974aca6d109d7fa88d7e610a61214ddee06f1fa09c287ade6f71182b999955c6d3674d5701b0f89326
- SSDEEP 3072:U0bRbeSCuF7PXuwFyoJ+mKTrZYzXlEmS6ZCHOoSnEYXosM:U2FeSCulPXuwIoWT9YlhD4d
- TLSH T1B304AE21B4C2C0B1E5B74A7022F8DBB56D7D7A601B3094EFA394077B8E344E26639D67
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
67459
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
FindFirstFileW
GetFileSizeEx
HeapFree
EnterCriticalSection
GetCommandLineW
FindNextFileW
GetCurrentProcess
lstrlenW
WriteFile
InterlockedDecrement
GetModuleFileNameW
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
SetErrorMode
GetQueuedCompletionStatus
CreateMutexW
FindClose
WaitForSingleObject
CreateFileW
GetCurrentThreadId
lstrcatA
GetModuleHandleA
PostQueuedCompletionStatus
SetFileAttributesW
Sleep
GetLastError
InterlockedExchange
CloseHandle
GetSystemInfo
LoadLibraryW
CreateThread
HeapAlloc
GetProcAddress
LocalFree
DeleteCriticalSection
ExitProcess
GetProcessHeap
SystemTimeToFileTime
lstrcpyW
InterlockedIncrement
GetSystemTime
lstrcmpiW
CreateIoCompletionPort
OpenMutexW
lstrcmpW
SetConsoleTitleW
MoveFileW
GetDriveTypeW
QueryPerformanceCounter
HeapReAlloc
HeapSize
WriteConsoleW
FlushFileBuffers
CancelIo
GetLogicalDrives
InterlockedExchangeAdd
ReadFile
GetStringTypeW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
DecodePointer
FindFirstFileExA
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetFileType
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwind
RaiseException
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
GetCommandLineA
GetACP
CompareStringW
LCMapStringW
user32
wsprintfW
GetKeyboardLayoutList
CharLowerW
advapi32
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
shell32
CommandLineToArgvW
ShellExecuteW
SHEmptyRecycleBinA
ole32
CoInitialize
CoSetProxyBlanket
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
shlwapi
PathFindFileNameW
StrStrW
PathAddBackslashW
PathRemoveFileSpecW
wnsprintfA
mpr
WNetEnumResourceW
WNetCloseEnum
WNetOpenEnumW
ntru_crypto_drbg_external_instantiate
ntru_crypto_drbg_generate
ntru_crypto_drbg_instantiate
ntru_crypto_drbg_reseed
ntru_crypto_drbg_uninstantiate
ntru_crypto_ntru_decrypt
ntru_crypto_ntru_encrypt
ntru_crypto_ntru_encrypt_keygen
ntru_crypto_ntru_encrypt_publicKey2SubjectPublicKeyInfo
ntru_crypto_ntru_encrypt_subjectPublicKeyInfo2PublicKey
Name
.text
Size
129KB
Virtual Size
129KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=241, version=40116,
count=137, id=243, version=40116,
count=24, id=242, version=40116,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=259, productName=VS2017 v15.6.6 build 26131, version=26131,
count=42, id=261, productName=VS2017 v15.6.6 build 26131, version=26131,
count=17, id=260, productName=VS2017 v15.6.6 build 26131, version=26131,
count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=154, id=1, productName=Unmarked objects,
count=27, id=265, version=26428,
count=1, id=256, productName=VS2017 v15.7.1 build 26428, version=26428,
count=1, id=258, productName=VS2017 v15.7.1 build 26428, version=26428,